tree 3725db17950fb8676e8a81a02f7b08cfa26c7264
parent 83acf0d67af5e7675c2b45538a1ea1990077c6dc
author Stephen Smalley <sds@tycho.nsa.gov> 1426005557 -0400
committer Jeff Vander Stoep <jeffv@google.com> 1428439089 -0700

checkpolicy:  Fix precedence between number and filesystem tokens.

When the FILESYSTEM token was added to support filesystem names that
start with a digit (e.g. 9p), it was given higher precedence than
NUMBER and therefore all values specified in hex (with 0x prefix)
in policy will incorrectly match FILESYSTEM and yield a syntax error.
This breaks use of iomem ranges in Xen policy and will break ioctl
command ranges in a future SELinux policy version.  Switch the
precedence.  This does mean that you cannot currently have a filesystem
with a name that happens to be 0x followed by a hexval but hopefully
that isn't an issue.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>